[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_219":220,"_221":222},"routes/_app.x.$handle.$name",{"_105":104,"_37":50,"_113":95,"_32":107,"_13":14,"_114":-5,"_11":115,"_116":117,"_118":119,"_120":121,"_122":123,"_26":-5,"_124":-5,"_125":-5,"_126":30,"_127":128,"_129":64,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_48":49,"_37":50,"_43":51,"_52":-5,"_53":30,"_54":55,"_56":55,"_57":58,"_59":-5,"_19":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":30},"version",8,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","1fb7f34a-d499-4cce-9f4b-43feae9176ed","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":14,"_46":47,"_29":30},"previous","deleted",false,"deletedHere","path","lib/merchants.ts","latestPath","fileId","34d51bea-8789-11f1-a92b-1607ee4eb77e","name","merchants.ts","fileType","script","content","/**\n * Merchant management — registration, profile, stats.\n */\n\nimport type { Merchant } from \"./types.ts\";\nimport { db } from \"./storage.ts\";\nimport {\n json,\n errorResponse,\n generateId,\n generateApiKey,\n} from \"./utils.ts\";\n\nexport async function registerMerchant(body: {\n name: string;\n phone: string;\n country: string;\n webhook_url: string;\n}): Promise {\n if (!body.name || !body.phone || !body.country || !body.webhook_url) {\n return errorResponse(\n \"Missing required fields: name, phone, country, webhook_url\",\n 422,\n );\n }\n\n const id = generateId();\n const apiKey = generateApiKey();\n const createdAt = new Date().toISOString();\n\n try {\n await db().execute({\n sql: `INSERT INTO merchants (id, name, phone, country, webhook_url, api_key, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [id, body.name, body.phone, body.country, body.webhook_url, apiKey, createdAt],\n });\n\n return json({\n merchant_id: id,\n api_key: apiKey,\n name: body.name,\n webhook_url: body.webhook_url,\n message: \"Merchant registered successfully. Store your API key securely.\",\n }, 201);\n } catch (err) {\n return errorResponse(\n `Merchant registration failed: ${(err as Error).message}`,\n 500,\n );\n }\n}\n\nexport async function getMerchantInfo(merchant: Merchant): Promise {\n return json({\n id: merchant.id,\n name: merchant.name,\n phone: merchant.phone,\n country: merchant.country,\n webhook_url: merchant.webhook_url,\n created_at: merchant.created_at,\n });\n}\n\n/** Public store info for the token-free storefront — no API key needed. */\nexport async function getPublicStoreInfo(\n merchantId: string,\n): Promise {\n try {\n const merchantResult = await db().execute({\n sql: \"SELECT id, name, country FROM merchants WHERE id = ?\",\n args: [merchantId],\n });\n if (merchantResult.rows.length === 0) {\n return errorResponse(\"Store not found\", 404);\n }\n\n const productResult = await db().execute({\n sql: \"SELECT id, name, price, description, stock, category, image_url FROM products WHERE merchant_id = ? ORDER BY created_at DESC\",\n args: [merchantId],\n });\n\n const orderResult = await db().execute({\n sql: \"SELECT COUNT(*) as count FROM orders WHERE merchant_id = ?\",\n args: [merchantId],\n });\n\n return json({\n merchant: merchantResult.rows[0],\n products: productResult.rows,\n product_count: productResult.rows.length,\n total_orders: (orderResult.rows[0] as Record)?.count ?? 0,\n });\n } catch (err) {\n return errorResponse(\n `Failed to fetch store info: ${(err as Error).message}`,\n 500,\n );\n }\n}\n\n/** Dashboard stats for the authenticated merchant. */\nexport async function getMerchantStats(\n merchant: Merchant,\n): Promise {\n try {\n const [productResult, orderResult, pendingResult, revenueResult] =\n await Promise.all([\n db().execute({\n sql: \"SELECT COUNT(*) as count FROM products WHERE merchant_id = ?\",\n args: [merchant.id],\n }),\n db().execute({\n sql: \"SELECT COUNT(*) as count FROM orders WHERE merchant_id = ?\",\n args: [merchant.id],\n }),\n db().execute({\n sql: \"SELECT COUNT(*) as count FROM orders WHERE merchant_id = ? AND status = 'booked'\",\n args: [merchant.id],\n }),\n db().execute({\n sql: \"SELECT COALESCE(SUM(total_price), 0) as revenue FROM orders WHERE merchant_id = ? AND status != 'cancelled'\",\n args: [merchant.id],\n }),\n ]);\n\n return json({\n product_count: (productResult.rows[0] as Record)?.count ?? 0,\n total_orders: (orderResult.rows[0] as Record)?.count ?? 0,\n pending_orders: (pendingResult.rows[0] as Record)?.count ?? 0,\n revenue: (revenueResult.rows[0] as Record)?.revenue ?? 0,\n });\n } catch (err) {\n return errorResponse(\n `Failed to fetch stats: ${(err as Error).message}`,\n 500,\n );\n }\n}\n","createdAt",["D",1784915879160],"branchVersion","branchId","a336bfb1-1072-4277-b7fc-005e38ac2fe6","id","9de191f9-48f6-48da-aac9-14e998a3990a","multi-tenant-commerce-engine",["D",1784711864701],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Multi-tenant e-commerce with AI chatbot, storefront & dashboard","imageUrl","e6b73de9-15b6-4de0-855b-91420681c7c7","pinnedFileId","32bdfec6-85ae-11f1-94b9-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8918-ca48-713a-b13d-08dd6e21c61e","tursoName","9de191f948f648daaac914e998a3990a","tursoHostname","9de191f948f648daaac914e998a3990a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789572079973],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_105":104,"_112":107},"org",{"_105":104,"_106":107,"_108":107,"_19":60,"_109":110,"_111":30},"branch",{"_13":94,"_37":95,"_48":47,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"isOwned",19,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","tokigo7440","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_48":49,"_37":50,"_43":214,"_52":-5,"_53":30,"_54":55,"_56":55,"_57":58,"_59":-5,"_19":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":215,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":216,"_89":217,"_91":218,"_93":30},"tree",[165,171],"files",[165,166,167,168,169,170,171],"counts",{"_154":68,"_155":156,"_157":68,"_158":159,"_160":161},"contents",[134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_48":147,"_37":148,"_35":149,"_138":-5,"_46":47,"_45":150,"_140":64,"_43":151,"_13":68,"_39":152,"_41":-5,"_29":30,"_145":-5,"_32":153},{"_48":136,"_37":137,"_35":62,"_138":-5,"_46":47,"_45":139,"_140":30,"_43":141,"_13":142,"_39":143,"_41":144,"_29":30,"_145":-5,"_32":146},"82fce257-ff25-41bd-97e8-9cf089eac1b7","main.ts","parentId",3,"latest",["D",1784712150751],2,"http","/**\n * Multi-Tenant Commerce Engine\n * ─────────────────────────────\n * Single-file HTTP Val providing:\n * 1. Multi-tenant merchant isolation via Val Town SQLite\n * 2. Zero-cost contextual AI chatbot (/api/chat)\n * 3. Automated order booking with customer info extraction\n * 4. Supplier dispatch webhook notifications\n *\n * Every query is scoped by merchant_id — cross-tenant reads are\n * structurally impossible because the WHERE clause is always present.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// ═══════════════════════════════════════════════════════════════\n// TYPES\n// ═══════════════════════════════════════════════════════════════\n\ninterface Merchant {\n id: string;\n name: string;\n phone: string;\n country: string;\n webhook_url: string;\n api_key: string;\n created_at: string;\n}\n\ninterface Product {\n id: number;\n merchant_id: string;\n name: string;\n price: number;\n description: string;\n stock: number;\n category: string;\n image_url: string;\n created_at: string;\n}\n\ninterface Order {\n id: number;\n merchant_id: string;\n customer_name: string;\n customer_phone: string;\n customer_address: string;\n product_id: number;\n product_name: string;\n quantity: number;\n total_price: number;\n status: string;\n created_at: string;\n}\n\ninterface ChatSession {\n id: string;\n merchant_id: string;\n customer_name: string | null;\n customer_phone: string | null;\n customer_address: string | null;\n product_id: number | null;\n product_name: string | null;\n quantity: number | null;\n state: string;\n updated_at: string;\n}\n\ntype JsonResponse = Response;\n\n// ═══════════════════════════════════════════════════════════════\n// DATABASE INITIALIZATION\n// ═══════════════════════════════════════════════════════════════\n\nasync function initDatabase(): Promise {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS merchants (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n country TEXT NOT NULL,\n webhook_url TEXT NOT NULL,\n api_key TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS products (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n merchant_id TEXT NOT NULL,\n name TEXT NOT NULL,\n price REAL NOT NULL,\n description TEXT DEFAULT '',\n stock INTEGER DEFAULT 0,\n category TEXT DEFAULT 'general',\n image_url TEXT DEFAULT '',\n created_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS orders (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n merchant_id TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n customer_phone TEXT NOT NULL,\n customer_address TEXT NOT NULL,\n product_id INTEGER NOT NULL,\n product_name TEXT NOT NULL,\n quantity INTEGER NOT NULL,\n total_price REAL NOT NULL,\n status TEXT DEFAULT 'booked',\n created_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id),\n FOREIGN KEY (product_id) REFERENCES products(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS chat_sessions (\n id TEXT PRIMARY KEY,\n merchant_id TEXT NOT NULL,\n customer_name TEXT,\n customer_phone TEXT,\n customer_address TEXT,\n product_id INTEGER,\n product_name TEXT,\n quantity INTEGER,\n state TEXT DEFAULT 'browsing',\n updated_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id)\n )\n `);\n\n await sqlite.execute(`\n CREATE INDEX IF NOT EXISTS idx_products_merchant ON products(merchant_id)\n `);\n await sqlite.execute(`\n CREATE INDEX IF NOT EXISTS idx_orders_merchant ON orders(merchant_id)\n `);\n await sqlite.execute(`\n CREATE INDEX IF NOT EXISTS idx_chat_sessions_merchant ON chat_sessions(merchant_id)\n `);\n}\n\n// ═══════════════════════════════════════════════════════════════\n// UTILITY FUNCTIONS\n// ═══════════════════════════════════════════════════════════════\n\nfunction json(data: unknown, status = 200): JsonResponse {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Merchant-Key\",\n },\n });\n}\n\nfunction errorResponse(message: string, status = 400): JsonResponse {\n return json({ error: message }, status);\n}\n\nfunction generateId(): string {\n return \"mrc_\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 16);\n}\n\nfunction generateApiKey(): string {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return \"sk_\" + Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction generateSessionId(): string {\n return \"ses_\" + crypto.randomUUID().replace(/-/g, \"\");\n}\n\nasync function authenticateMerchant(apiKey: string): Promise {\n if (!apiKey) return null;\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM merchants WHERE api_key = ?\",\n args: [apiKey],\n });\n if (result.rows.length === 0) return null;\n return result.rows[0] as unknown as Merchant;\n } catch {\n return null;\n }\n}\n\nasync function getMerchantById(merchantId: string): Promise {\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM merchants WHERE id = ?\",\n args: [merchantId],\n });\n if (result.rows.length === 0) return null;\n return result.rows[0] as unknown as Merchant;\n } catch {\n return null;\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// MERCHANT MANAGEMENT\n// ═══════════════════════════════════════════════════════════════\n\nasync function registerMerchant(body: {\n name: string;\n phone: string;\n country: string;\n webhook_url: string;\n}): Promise {\n if (!body.name || !body.phone || !body.country || !body.webhook_url) {\n return errorResponse(\"Missing required fields: name, phone, country, webhook_url\", 422);\n }\n\n const id = generateId();\n const apiKey = generateApiKey();\n const createdAt = new Date().toISOString();\n\n try {\n await sqlite.execute({\n sql: `INSERT INTO merchants (id, name, phone, country, webhook_url, api_key, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [id, body.name, body.phone, body.country, body.webhook_url, apiKey, createdAt],\n });\n\n return json({\n merchant_id: id,\n api_key: apiKey,\n name: body.name,\n webhook_url: body.webhook_url,\n message: \"Merchant registered successfully. Store your API key securely.\",\n }, 201);\n } catch (err) {\n return errorResponse(`Merchant registration failed: ${(err as Error).message}`, 500);\n }\n}\n\nasync function getMerchantInfo(merchant: Merchant): Promise {\n return json({\n id: merchant.id,\n name: merchant.name,\n phone: merchant.phone,\n country: merchant.country,\n webhook_url: merchant.webhook_url,\n created_at: merchant.created_at,\n });\n}\n\n// ═══════════════════════════════════════════════════════════════\n// PRODUCT MANAGEMENT — every query includes merchant_id WHERE clause\n// ═══════════════════════════════════════════════════════════════\n\nasync function listProducts(merchantId: string): Promise {\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM products WHERE merchant_id = ? ORDER BY created_at DESC\",\n args: [merchantId],\n });\n return json({ products: result.rows, count: result.rows.length });\n } catch (err) {\n return errorResponse(`Failed to list products: ${(err as Error).message}`, 500);\n }\n}\n\nasync function addProduct(merchantId: string, body: {\n name: string;\n price: number;\n description?: string;\n stock?: number;\n category?: string;\n image_url?: string;\n}): Promise {\n if (!body.name || body.price === undefined) {\n return errorResponse(\"Missing required fields: name, price\", 422);\n }\n\n const createdAt = new Date().toISOString();\n\n try {\n await sqlite.execute({\n sql: `INSERT INTO products (merchant_id, name, price, description, stock, category, image_url, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n merchantId,\n body.name,\n body.price,\n body.description || \"\",\n body.stock ?? 0,\n body.category || \"general\",\n body.image_url || \"\",\n createdAt,\n ],\n });\n\n const result = await sqlite.execute({\n sql: \"SELECT * FROM products WHERE merchant_id = ? AND name = ? ORDER BY id DESC LIMIT 1\",\n args: [merchantId, body.name],\n });\n\n return json({ product: result.rows[0], message: \"Product added successfully\" }, 201);\n } catch (err) {\n return errorResponse(`Failed to add product: ${(err as Error).message}`, 500);\n }\n}\n\nasync function deleteProduct(merchantId: string, productId: number): Promise {\n try {\n const result = await sqlite.execute({\n sql: \"DELETE FROM products WHERE id = ? AND merchant_id = ?\",\n args: [productId, merchantId],\n });\n\n if (result.rowsAffected === 0) {\n return errorResponse(\"Product not found or not owned by this merchant\", 404);\n }\n\n return json({ message: \"Product deleted successfully\" });\n } catch (err) {\n return errorResponse(`Failed to delete product: ${(err as Error).message}`, 500);\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// ORDER MANAGEMENT — every query includes merchant_id WHERE clause\n// ═══════════════════════════════════════════════════════════════\n\nasync function listOrders(merchantId: string): Promise {\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM orders WHERE merchant_id = ? ORDER BY created_at DESC\",\n args: [merchantId],\n });\n return json({ orders: result.rows, count: result.rows.length });\n } catch (err) {\n return errorResponse(`Failed to list orders: ${(err as Error).message}`, 500);\n }\n}\n\nasync function updateOrderStatus(merchantId: string, orderId: number, status: string): Promise {\n const validStatuses = [\"booked\", \"dispatched\", \"delivered\", \"cancelled\"];\n if (!validStatuses.includes(status)) {\n return errorResponse(`Invalid status. Must be one of: ${validStatuses.join(\", \")}`, 422);\n }\n\n try {\n const result = await sqlite.execute({\n sql: \"UPDATE orders SET status = ? WHERE id = ? AND merchant_id = ?\",\n args: [status, orderId, merchantId],\n });\n\n if (result.rowsAffected === 0) {\n return errorResponse(\"Order not found or not owned by this merchant\", 404);\n }\n\n return json({ message: \"Order status updated\", order_id: orderId, status });\n } catch (err) {\n return errorResponse(`Failed to update order: ${(err as Error).message}`, 500);\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// AI CHATBOT ENGINE — zero-cost contextual NLP\n// ═══════════════════════════════════════════════════════════════\n\n// Intent detection keywords\nconst GREETING_WORDS = [\"hi\", \"hello\", \"hey\", \"greetings\", \"good morning\", \"good afternoon\", \"good evening\", \"salam\", \"hola\", \"namaste\"];\nconst PRODUCT_INQUIRY_WORDS = [\"what do you have\", \"show products\", \"catalog\", \"catalogue\", \"list products\", \"what can i buy\", \"what do you sell\", \"show me\", \"browse\", \"items\", \"what items\"];\nconst PRICE_WORDS = [\"price\", \"cost\", \"how much\", \"how many dollars\", \"rate\", \"pricing\"];\nconst AVAILABILITY_WORDS = [\"available\", \"in stock\", \"do you have\", \"got any\", \"is there\", \"still have\"];\nconst PURCHASE_WORDS = [\"buy\", \"order\", \"purchase\", \"want\", \"need\", \"get this\", \"ship to me\", \"deliver\", \"i'd like\", \"i would like\", \"take\", \"grab\", \"book\"];\nconst CONFIRM_WORDS = [\"yes\", \"confirm\", \"correct\", \"that's right\", \"thats right\", \"yeah\", \"yep\", \"sure\", \"ok\", \"okay\"];\nconst CANCEL_WORDS = [\"no\", \"cancel\", \"never mind\", \"nevermind\", \"stop\", \"abort\", \"exit\", \"quit\"];\n\n// Phone number regex — matches international and local formats\nconst PHONE_REGEX = /(\\+?\\d{1,3}[-.\\s]?)?\$?\\d{2,4}\$?[-.\\s]?\\d{3,5}[-.\\s]?\\d{3,5}/g;\n\n// Quantity extraction\nfunction extractQuantity(text: string): number | null {\n const lower = text.toLowerCase();\n const numberWords: Record = {\n \"one\": 1, \"two\": 2, \"three\": 3, \"four\": 4, \"five\": 5,\n \"six\": 6, \"seven\": 7, \"eight\": 8, \"nine\": 9, \"ten\": 10,\n \"a dozen\": 12, \"dozen\": 12,\n };\n\n // Check \"quantity: X\" or \"qty: X\" patterns\n const qtyPattern = /(?:quantity|qty)[:\\s]+(\\d+)/i;\n const qtyMatch = lower.match(qtyPattern);\n if (qtyMatch) return parseInt(qtyMatch[1]);\n\n // Check \"X units/pieces/items\"\n const unitPattern = /(\\d+)\\s*(?:units?|pieces?|items?|pcs)/i;\n const unitMatch = lower.match(unitPattern);\n if (unitMatch) return parseInt(unitMatch[1]);\n\n // Check number words\n for (const [word, num] of Object.entries(numberWords)) {\n if (lower.includes(word)) return num;\n }\n\n // Check standalone number\n const numMatch = text.match(/\\b(\\d+)\\b/);\n if (numMatch) return parseInt(numMatch[1]);\n\n return null;\n}\n\n// Extract phone number from text\nfunction extractPhone(text: string): string | null {\n const matches = text.match(PHONE_REGEX);\n if (matches && matches.length > 0) {\n const phone = matches[0].trim();\n // Validate minimum length (at least 7 digits)\n const digits = phone.replace(/\\D/g, \"\");\n if (digits.length >= 7) return phone;\n }\n return null;\n}\n\n// Check if text looks like an address\nfunction looksLikeAddress(text: string): boolean {\n const lower = text.toLowerCase();\n const addressIndicators = [\n \"street\", \"st\", \"avenue\", \"ave\", \"road\", \"rd\", \"lane\", \"ln\",\n \"block\", \"sector\", \"house\", \"apartment\", \"apt\", \"floor\", \"flat\",\n \"building\", \"city\", \"town\", \"district\", \"zone\", \"phase\",\n \"near\", \"opposite\", \"beside\", \"behind\", \"plot\", \"no.\", \"number\",\n ];\n const hasNumber = /\\d/.test(text);\n const hasIndicator = addressIndicators.some((ind) => lower.includes(ind));\n return (hasNumber && hasIndicator) || (hasNumber && text.split(/\\s+/).length >= 3) || (hasIndicator && text.split(/\\s+/).length >= 2);\n}\n\n// Match user message against product catalog\nfunction matchProducts(message: string, products: Product[]): Product[] {\n const lower = message.toLowerCase();\n const matches: Product[] = [];\n\n for (const product of products) {\n const productName = product.name.toLowerCase();\n const productDesc = product.description.toLowerCase();\n const productCategory = product.category.toLowerCase();\n\n // Exact name match\n if (lower.includes(productName)) {\n matches.push(product);\n continue;\n }\n\n // Match on individual words in the product name (for multi-word products)\n const nameWords = productName.split(/\\s+/).filter((w) => w.length > 3);\n const matchedWords = nameWords.filter((w) => lower.includes(w));\n if (matchedWords.length >= 1 && nameWords.length > 0) {\n matches.push(product);\n continue;\n }\n\n // Match on category\n if (productCategory !== \"general\" && lower.includes(productCategory)) {\n matches.push(product);\n continue;\n }\n\n // Match on description keywords\n if (productDesc && productDesc.length > 0) {\n const descWords = productDesc.split(/\\s+/).filter((w) => w.length > 4);\n const matchedDescWords = descWords.filter((w) => lower.includes(w));\n if (matchedDescWords.length >= 2) {\n matches.push(product);\n continue;\n }\n }\n }\n\n return matches;\n}\n\n// Check for purchase intent\nfunction hasPurchaseIntent(message: string): boolean {\n const lower = message.toLowerCase();\n return PURCHASE_WORDS.some((word) => lower.includes(word));\n}\n\n// Check for greeting\nfunction isGreeting(message: string): boolean {\n const lower = message.toLowerCase().trim();\n return GREETING_WORDS.some((word) => lower === word || lower.startsWith(word + \" \") || lower.startsWith(word + \"!\"));\n}\n\n// Check for product inquiry\nfunction isProductInquiry(message: string): boolean {\n const lower = message.toLowerCase();\n return PRODUCT_INQUIRY_WORDS.some((word) => lower.includes(word));\n}\n\n// Check for price inquiry\nfunction isPriceInquiry(message: string): boolean {\n const lower = message.toLowerCase();\n return PRICE_WORDS.some((word) => lower.includes(word));\n}\n\n// Check for availability inquiry\nfunction isAvailabilityInquiry(message: string): boolean {\n const lower = message.toLowerCase();\n return AVAILABILITY_WORDS.some((word) => lower.includes(word));\n}\n\n// Check for confirmation\nfunction isConfirmation(message: string): boolean {\n const lower = message.toLowerCase().trim();\n return CONFIRM_WORDS.some((word) => lower === word || lower.startsWith(word));\n}\n\n// Check for cancellation\nfunction isCancellation(message: string): boolean {\n const lower = message.toLowerCase().trim();\n return CANCEL_WORDS.some((word) => lower === word || lower.startsWith(word));\n}\n\n// Build product list text for chatbot responses\nfunction formatProductList(products: Product[]): string {\n if (products.length === 0) return \"I'm sorry, but this store currently has no products in the catalog. Please check back soon!\";\n\n let text = \"Here are the available products:\\n\\n\";\n for (const p of products) {\n const stockInfo = p.stock > 0 ? `✅ In stock (${p.stock} available)` : \"❌ Out of stock\";\n text += `📦 **${p.name}**\\n`;\n text += ` Price: $${p.price.toFixed(2)}\\n`;\n if (p.description) text += ` ${p.description}\\n`;\n text += ` ${stockInfo}\\n\\n`;\n }\n text += \"To place an order, just say 'I want to buy [product name]' and I'll help you check out!\";\n return text;\n}\n\n// Get or create chat session\nasync function getOrCreateSession(sessionId: string | undefined, merchantId: string): Promise {\n if (sessionId) {\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM chat_sessions WHERE id = ? AND merchant_id = ?\",\n args: [sessionId, merchantId],\n });\n if (result.rows.length > 0) {\n return result.rows[0] as unknown as ChatSession;\n }\n } catch {\n // fall through to create new\n }\n }\n\n const newId = sessionId || generateSessionId();\n const now = new Date().toISOString();\n\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO chat_sessions (id, merchant_id, state, updated_at)\n VALUES (?, ?, 'browsing', ?)`,\n args: [newId, merchantId, now],\n });\n\n return {\n id: newId,\n merchant_id: merchantId,\n customer_name: null,\n customer_phone: null,\n customer_address: null,\n product_id: null,\n product_name: null,\n quantity: null,\n state: \"browsing\",\n updated_at: now,\n };\n}\n\n// Update chat session\nasync function updateSession(session: ChatSession, updates: Partial): Promise {\n const now = new Date().toISOString();\n // Mutate the local session object so subsequent references in the\n // same request see the updated values (e.g. session.product_name).\n Object.assign(session, updates, { updated_at: now });\n\n await sqlite.execute({\n sql: `UPDATE chat_sessions\n SET customer_name = ?, customer_phone = ?, customer_address = ?,\n product_id = ?, product_name = ?, quantity = ?, state = ?, updated_at = ?\n WHERE id = ? AND merchant_id = ?`,\n args: [\n session.customer_name,\n session.customer_phone,\n session.customer_address,\n session.product_id,\n session.product_name,\n session.quantity,\n session.state,\n now,\n session.id,\n session.merchant_id,\n ],\n });\n}\n\n// Delete chat session after order completion\nasync function deleteSession(sessionId: string, merchantId: string): Promise {\n try {\n await sqlite.execute({\n sql: \"DELETE FROM chat_sessions WHERE id = ? AND merchant_id = ?\",\n args: [sessionId, merchantId],\n });\n } catch {\n // non-fatal\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// ORDER BOOKING — atomic transaction within merchant scope\n// ═══════════════════════════════════════════════════════════════\n\nasync function bookOrder(\n merchantId: string,\n product: Product,\n customerName: string,\n customerPhone: string,\n customerAddress: string,\n quantity: number,\n): Promise<{ success: boolean; order?: Order; error?: string }> {\n const totalPrice = product.price * quantity;\n const createdAt = new Date().toISOString();\n\n try {\n // Atomic: insert order + decrement stock\n await sqlite.batch([\n {\n sql: `INSERT INTO orders (merchant_id, customer_name, customer_phone, customer_address, product_id, product_name, quantity, total_price, status, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'booked', ?)`,\n args: [merchantId, customerName, customerPhone, customerAddress, product.id, product.name, quantity, totalPrice, createdAt],\n },\n {\n sql: \"UPDATE products SET stock = stock - ? WHERE id = ? AND merchant_id = ?\",\n args: [quantity, product.id, merchantId],\n },\n ]);\n\n const result = await sqlite.execute({\n sql: \"SELECT * FROM orders WHERE merchant_id = ? ORDER BY id DESC LIMIT 1\",\n args: [merchantId],\n });\n\n const order = result.rows[0] as unknown as Order;\n return { success: true, order };\n } catch (err) {\n return { success: false, error: (err as Error).message };\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// SUPPLIER DISPATCH NOTIFICATION\n// ═══════════════════════════════════════════════════════════════\n\nasync function dispatchSupplierNotification(merchant: Merchant, order: Order): Promise<{ success: boolean; error?: string }> {\n const payload = {\n event: \"new_order\",\n merchant_id: merchant.id,\n merchant_name: merchant.name,\n order_id: order.id,\n message: `New Order Booked by AI Agent. Customer Name: ${order.customer_name}, Address: ${order.customer_address}, Item: ${order.product_name} (Qty: ${order.quantity}). ACTION REQUIRED: Please ship this order MANUALLY now.`,\n order_details: {\n customer_name: order.customer_name,\n customer_phone: order.customer_phone,\n customer_address: order.customer_address,\n product_name: order.product_name,\n quantity: order.quantity,\n total_price: order.total_price,\n order_id: order.id,\n created_at: order.created_at,\n },\n timestamp: new Date().toISOString(),\n };\n\n try {\n const response = await fetch(merchant.webhook_url, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"X-Order-Source\": \"AI-Agent\",\n \"X-Merchant-Id\": merchant.id,\n },\n body: JSON.stringify(payload),\n signal: AbortSignal.timeout(10000),\n });\n\n if (!response.ok) {\n return { success: false, error: `Webhook returned ${response.status}` };\n }\n\n return { success: true };\n } catch (err) {\n return { success: false, error: (err as Error).message };\n }\n}\n\n// ═══════════════════════════════════════════════════════════════\n// CHATBOT CONVERSATION PROCESSOR\n// ═══════════════════════════════════════════════════════════════\n\ninterface ChatResponse {\n reply: string;\n session_id: string;\n order_booked: boolean;\n order_id?: number;\n dispatch_sent?: boolean;\n dispatch_error?: string;\n}\n\nasync function processChatMessage(\n merchantId: string,\n message: string,\n sessionId?: string,\n): Promise {\n // Validate merchant exists\n const merchant = await getMerchantById(merchantId);\n if (!merchant) {\n return {\n reply: \"Error: This store is not available. Please contact support.\",\n session_id: sessionId || \"\",\n order_booked: false,\n };\n }\n\n // Load merchant's products\n let products: Product[] = [];\n try {\n const productResult = await sqlite.execute({\n sql: \"SELECT * FROM products WHERE merchant_id = ? ORDER BY name\",\n args: [merchantId],\n });\n products = productResult.rows as unknown as Product[];\n } catch {\n return {\n reply: \"I'm having trouble accessing the product catalog right now. Please try again in a moment.\",\n session_id: sessionId || \"\",\n order_booked: false,\n };\n }\n\n // Get or create session\n const session = await getOrCreateSession(sessionId, merchantId);\n\n const lowerMsg = message.toLowerCase().trim();\n\n // ── Handle cancellation ──────────────────────────────────────\n if (isCancellation(message) && session.state !== \"browsing\") {\n await deleteSession(session.id, merchantId);\n return {\n reply: \"Your order has been cancelled. Let me know if you'd like to browse or buy something else!\",\n session_id: generateSessionId(),\n order_booked: false,\n };\n }\n\n // ── State machine: BROWSING ──────────────────────────────────\n if (session.state === \"browsing\") {\n // Greeting\n if (isGreeting(message)) {\n const welcomeMsg = products.length > 0\n ? `Hello! Welcome to ${merchant.name}! 🛍️\\n\\n${formatProductList(products)}`\n : `Hello! Welcome to ${merchant.name}! 🛍️\\n\\nOur catalog is currently being updated. Please check back soon!`;\n return { reply: welcomeMsg, session_id: session.id, order_booked: false };\n }\n\n // Product inquiry\n if (isProductInquiry(message)) {\n return {\n reply: formatProductList(products),\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Price inquiry\n if (isPriceInquiry(message)) {\n const matched = matchProducts(message, products);\n if (matched.length > 0) {\n let reply = \"Here are the prices:\\n\\n\";\n for (const p of matched) {\n reply += `📦 ${p.name}: $${p.price.toFixed(2)}\\n`;\n if (p.stock > 0) reply += ` ✅ In stock (${p.stock} available)\\n`;\n else reply += ` ❌ Out of stock\\n`;\n }\n reply += \"\\nTo order, say 'I want to buy [product name]'.\";\n return { reply, session_id: session.id, order_booked: false };\n }\n return {\n reply: \"Which product are you asking about? Here's what we have:\\n\\n\" + formatProductList(products),\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Availability inquiry\n if (isAvailabilityInquiry(message)) {\n const matched = matchProducts(message, products);\n if (matched.length > 0) {\n let reply = \"Availability:\\n\\n\";\n for (const p of matched) {\n if (p.stock > 0) reply += `✅ ${p.name} — ${p.stock} in stock\\n`;\n else reply += `❌ ${p.name} — Out of stock\\n`;\n }\n return { reply, session_id: session.id, order_booked: false };\n }\n return {\n reply: \"Which product are you checking? Here's our catalog:\\n\\n\" + formatProductList(products),\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Purchase intent — start order flow\n if (hasPurchaseIntent(message)) {\n const matched = matchProducts(message, products);\n if (matched.length === 0) {\n return {\n reply: `I'd love to help you place an order! Which product would you like to buy? Here's what we have:\\n\\n${formatProductList(products)}`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Pick the first matched product\n const product = matched[0];\n if (product.stock <= 0) {\n return {\n reply: `I'm sorry, ${product.name} is currently out of stock. Would you like to see other available products?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Try to extract all info from this first message\n const phone = extractPhone(message);\n const qty = extractQuantity(message) || 1;\n const hasName = lowerMsg.includes(\"name is\") || lowerMsg.includes(\"i'm\") || lowerMsg.includes(\"i am\") || lowerMsg.includes(\"my name\");\n const hasAddress = looksLikeAddress(message);\n\n // Extract name if present\n let extractedName: string | null = null;\n const nameMatch = message.match(/(?:name is|i am|i'm|my name is)\\s+([A-Za-z\\s]{2,40})/i);\n if (nameMatch) extractedName = nameMatch[1].trim();\n\n // Extract address if present — look for address keywords\n let extractedAddress: string | null = null;\n const addrMatch = message.match(/(?:address is|live at|deliver to|ship to|at)\\s+(.{5,120})/i);\n if (addrMatch) extractedAddress = addrMatch[1].trim();\n\n // Update session with product + any extracted info\n await updateSession(session, {\n product_id: product.id,\n product_name: product.name,\n quantity: qty,\n customer_name: extractedName,\n customer_phone: phone,\n customer_address: extractedAddress,\n state: \"ordering\",\n });\n\n // Check what's still missing\n if (!extractedName) {\n await updateSession(session, { state: \"awaiting_name\" });\n return {\n reply: `Great choice! You want to order ${product.name} (${qty} × $${product.price.toFixed(2)} = $${(product.price * qty).toFixed(2)}).\\n\\nTo complete your order, I'll need a few details.\\n\\nWhat is your full name?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n if (!phone) {\n await updateSession(session, { state: \"awaiting_phone\" });\n return {\n reply: `Thank you, ${extractedName}! What is your phone number?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n if (!extractedAddress) {\n await updateSession(session, { state: \"awaiting_address\" });\n return {\n reply: `Got it! What is your delivery address?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // All info present — confirm and book\n const updatedSession = { ...session, customer_name: extractedName, customer_phone: phone, customer_address: extractedAddress, product_id: product.id, product_name: product.name, quantity: qty };\n return await finalizeOrder(updatedSession as ChatSession, product, merchant);\n }\n\n // Try to match products even without explicit purchase/inquiry keywords\n const matched = matchProducts(message, products);\n if (matched.length > 0) {\n let reply = \"I found these products that match:\\n\\n\";\n for (const p of matched) {\n reply += `📦 ${p.name} — $${p.price.toFixed(2)}`;\n if (p.description) reply += ` (${p.description})`;\n reply += p.stock > 0 ? ` ✅\\n` : ` ❌ Out of stock\\n`;\n }\n reply += \"\\nWould you like to buy any of these? Just say 'I want to buy [product name]'.\";\n return { reply, session_id: session.id, order_booked: false };\n }\n\n // Default fallback\n return {\n reply: `I'm here to help you with your shopping at ${merchant.name}! You can:\\n• Ask \"what products do you have?\" to browse\\n• Ask about prices or availability\\n• Say \"I want to buy [product name]\" to place an order\\n\\nHow can I assist you today?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // ── State machine: AWAITING_NAME ─────────────────────────────\n if (session.state === \"awaiting_name\") {\n const name = message.trim().replace(/^(my name is|name is|i am|i'm)\\s+/i, \"\").trim();\n if (name.length < 2) {\n return {\n reply: \"Please provide a valid name (at least 2 characters). What is your full name?\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n await updateSession(session, { customer_name: name, state: \"awaiting_phone\" });\n\n // Try to extract phone from same message\n const phone = extractPhone(message);\n if (phone && phone !== name) {\n await updateSession(session, { customer_phone: phone, state: \"awaiting_address\" });\n return {\n reply: `Thank you, ${name}! I got your phone number: ${phone}. What is your delivery address?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n return {\n reply: `Thank you, ${name}! What is your phone number?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // ── State machine: AWAITING_PHONE ────────────────────────────\n if (session.state === \"awaiting_phone\") {\n const phone = extractPhone(message);\n if (!phone) {\n return {\n reply: \"I couldn't detect a valid phone number. Please enter your phone number (e.g., +1234567890).\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n await updateSession(session, { customer_phone: phone, state: \"awaiting_address\" });\n\n // Try to extract address from same message\n const addrMatch = message.match(/(?:address is|live at|deliver to|ship to|at)\\s+(.{5,120})/i);\n if (addrMatch) {\n const address = addrMatch[1].trim();\n await updateSession(session, { customer_address: address, state: \"awaiting_quantity\" });\n return {\n reply: `Got your address! How many units of ${session.product_name} would you like to order? (Default: 1)`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n return {\n reply: `Got it! Your phone number is ${phone}. What is your delivery address?`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // ── State machine: AWAITING_ADDRESS ──────────────────────────\n if (session.state === \"awaiting_address\") {\n const address = message.trim().replace(/^(my address is|address is|deliver to|ship to|at)\\s+/i, \"\").trim();\n if (address.length < 5) {\n return {\n reply: \"Please provide a complete delivery address (street, city, etc.). What is your address?\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n await updateSession(session, { customer_address: address, state: \"awaiting_quantity\" });\n\n return {\n reply: `Perfect! How many units of ${session.product_name} would you like to order? (Just type a number, or say '1' for one unit)`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // ── State machine: AWAITING_QUANTITY ─────────────────────────\n if (session.state === \"awaiting_quantity\") {\n const qty = extractQuantity(message);\n const finalQty = qty || 1;\n\n if (qty && qty < 1) {\n return {\n reply: \"Please enter a valid quantity (1 or more). How many would you like?\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Load the product to check stock\n let product: Product | null = null;\n if (session.product_id) {\n try {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM products WHERE id = ? AND merchant_id = ?\",\n args: [session.product_id, merchantId],\n });\n if (result.rows.length > 0) product = result.rows[0] as unknown as Product;\n } catch {\n // fall through\n }\n }\n\n if (!product) {\n await updateSession(session, { state: \"browsing\" });\n return {\n reply: \"Sorry, the product you selected is no longer available. Would you like to browse our catalog again?\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n if (finalQty > product.stock) {\n return {\n reply: `I'm sorry, we only have ${product.stock} units of ${product.name} in stock. Would you like to order ${product.stock} instead? (Type the quantity or say 'cancel')`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n await updateSession(session, { quantity: finalQty });\n const updatedSession = { ...session, quantity: finalQty };\n\n return await finalizeOrder(updatedSession as ChatSession, product, merchant);\n }\n\n // ── State machine: ORDERING (direct flow with all info) ──────\n if (session.state === \"ordering\") {\n // This shouldn't normally be reached, but handle gracefully\n await updateSession(session, { state: \"browsing\" });\n return {\n reply: \"It looks like something went wrong with your order. Let's start fresh — what would you like to do?\",\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // ── Unknown state — reset ────────────────────────────────────\n await updateSession(session, { state: \"browsing\" });\n return {\n reply: \"How can I help you? You can browse products or place an order.\",\n session_id: session.id,\n order_booked: false,\n };\n}\n\n// Finalize order: book + dispatch notification\nasync function finalizeOrder(\n session: ChatSession,\n product: Product,\n merchant: Merchant,\n): Promise {\n const name = session.customer_name!;\n const phone = session.customer_phone!;\n const address = session.customer_address!;\n const qty = session.quantity || 1;\n\n // Book the order atomically\n const bookingResult = await bookOrder(merchant.id, product, name, phone, address, qty);\n\n if (!bookingResult.success || !bookingResult.order) {\n return {\n reply: `I'm sorry, there was an issue booking your order: ${bookingResult.error}. Please try again or contact ${merchant.name} directly at ${merchant.phone}.`,\n session_id: session.id,\n order_booked: false,\n };\n }\n\n // Dispatch supplier notification\n const dispatchResult = await dispatchSupplierNotification(merchant, bookingResult.order);\n\n // Clean up session\n await deleteSession(session.id, merchant.id);\n\n const orderConfirmation = `✅ **Order Booked Successfully!**\\n\\n` +\n `Order ID: #${bookingResult.order.id}\\n` +\n `Product: ${product.name}\\n` +\n `Quantity: ${qty}\\n` +\n `Total: $${(product.price * qty).toFixed(2)}\\n\\n` +\n `Delivery Details:\\n` +\n `Name: ${name}\\n` +\n `Phone: ${phone}\\n` +\n `Address: ${address}\\n\\n` +\n `${dispatchResult.success ? \"📦 Your order has been forwarded to the supplier for manual shipping. You'll be contacted soon!\" : \"⚠️ Your order is confirmed, but there was a delay notifying the supplier. The merchant has your order on record.\"}\\n\\n` +\n `Thank you for shopping with ${merchant.name}! 🛍️`;\n\n return {\n reply: orderConfirmation,\n session_id: generateSessionId(),\n order_booked: true,\n order_id: bookingResult.order.id,\n dispatch_sent: dispatchResult.success,\n dispatch_error: dispatchResult.success ? undefined : dispatchResult.error,\n };\n}\n\n// ═══════════════════════════════════════════════════════════════\n// HTTP ROUTER\n// ═══════════════════════════════════════════════════════════════\n\nasync function handleRequest(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\");\n const method = req.method.toUpperCase();\n\n // Handle CORS preflight\n if (method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Merchant-Key\",\n },\n });\n }\n\n // ── Health check ─────────────────────────────────────────────\n if (path === \"/\" || path === \"/api/health\") {\n return json({\n status: \"operational\",\n service: \"Multi-Tenant Commerce Engine\",\n version: \"1.0.0\",\n endpoints: {\n merchant_register: \"POST /api/merchant/register\",\n merchant_info: \"GET /api/merchant (requires X-Merchant-Key)\",\n products_list: \"GET /api/products (requires X-Merchant-Key)\",\n products_add: \"POST /api/products (requires X-Merchant-Key)\",\n products_delete: \"DELETE /api/products/:id (requires X-Merchant-Key)\",\n orders_list: \"GET /api/orders (requires X-Merchant-Key)\",\n orders_update: \"PATCH /api/orders/:id (requires X-Merchant-Key)\",\n chat: \"POST /api/chat\",\n },\n });\n }\n\n // ── Parse body for POST/PATCH/PUT ────────────────────────────\n let body: any = {};\n if (method === \"POST\" || method === \"PATCH\" || method === \"PUT\") {\n try {\n const text = await req.text();\n if (text) body = JSON.parse(text);\n } catch {\n return errorResponse(\"Invalid JSON body\", 400);\n }\n }\n\n // ═════════════════════════════════════════════════════════════\n // PUBLIC ENDPOINTS\n // ═════════════════════════════════════════════════════════════\n\n // ── POST /api/merchant/register ──────────────────────────────\n if (path === \"/api/merchant/register\" && method === \"POST\") {\n return await registerMerchant(body);\n }\n\n // ── POST /api/chat ───────────────────────────────────────────\n if (path === \"/api/chat\" && method === \"POST\") {\n if (!body.merchant_id || !body.message) {\n return errorResponse(\"Missing required fields: merchant_id, message\", 422);\n }\n\n try {\n const result = await processChatMessage(body.merchant_id, body.message, body.session_id);\n return json(result);\n } catch (err) {\n return errorResponse(`Chat processing error: ${(err as Error).message}`, 500);\n }\n }\n\n // ═════════════════════════════════════════════════════════════\n // AUTHENTICATED ENDPOINTS — require X-Merchant-Key header\n // ═════════════════════════════════════════════════════════════\n\n const apiKey = req.headers.get(\"X-Merchant-Key\");\n const merchant = await authenticateMerchant(apiKey || \"\");\n\n const protectedRoutes = [\n \"/api/merchant\",\n \"/api/products\",\n \"/api/orders\",\n ];\n\n const isProtected = protectedRoutes.some((r) => path === r || path.startsWith(r + \"/\"));\n\n if (isProtected && !merchant) {\n return errorResponse(\"Unauthorized: Valid X-Merchant-Key header required\", 401);\n }\n\n // ── GET /api/merchant ────────────────────────────────────────\n if (path === \"/api/merchant\" && method === \"GET\" && merchant) {\n return await getMerchantInfo(merchant);\n }\n\n // ── GET /api/products ────────────────────────────────────────\n if (path === \"/api/products\" && method === \"GET\" && merchant) {\n return await listProducts(merchant.id);\n }\n\n // ── POST /api/products ───────────────────────────────────────\n if (path === \"/api/products\" && method === \"POST\" && merchant) {\n return await addProduct(merchant.id, body);\n }\n\n // ── DELETE /api/products/:id ─────────────────────────────────\n const productDeleteMatch = path.match(/^\\/api\\/products\\/(\\d+)$/);\n if (productDeleteMatch && method === \"DELETE\" && merchant) {\n return await deleteProduct(merchant.id, parseInt(productDeleteMatch[1]));\n }\n\n // ── GET /api/orders ──────────────────────────────────────────\n if (path === \"/api/orders\" && method === \"GET\" && merchant) {\n return await listOrders(merchant.id);\n }\n\n // ── PATCH /api/orders/:id ────────────────────────────────────\n const orderPatchMatch = path.match(/^\\/api\\/orders\\/(\\d+)$/);\n if (orderPatchMatch && method === \"PATCH\" && merchant) {\n if (!body.status) {\n return errorResponse(\"Missing required field: status\", 422);\n }\n return await updateOrderStatus(merchant.id, parseInt(orderPatchMatch[1]), body.status);\n }\n\n // ── 404 ──────────────────────────────────────────────────────\n return errorResponse(`Route not found: ${method} ${path}`, 404);\n}\n\n// ═══════════════════════════════════════════════════════════════\n// MAIN HANDLER — initializes DB on first call, then routes\n// ═══════════════════════════════════════════════════════════════\n\nlet dbInitialized = false;\n\nexport default async function server(request: Request): Promise {\n try {\n if (!dbInitialized) {\n await initDatabase();\n dbInitialized = true;\n }\n return await handleRequest(request);\n } catch (err) {\n const message = err instanceof Error ? err.message : \"Unknown server error\";\n console.error(\"[FATAL]\", message, (err as Error)?.stack);\n return errorResponse(`Internal server error: ${message}`, 500);\n }\n}\n","label",[137],"5de464d3-7b28-4672-afcb-ef648aaf1e6d","lib","8391a2ad-4660-4274-aa7d-baf3ec4c023d",4,["D",1784915835212],"directory",[148],"pulls","branches",1,"forks","envVars",{"_162":68,"_164":68},"connections",{"_162":68,"_163":68},"count","unfilledCount","emptyCount",{"_48":147,"_37":148,"_35":149,"_138":-5,"_46":47,"_45":150,"_140":64,"_43":211,"_13":68,"_39":152,"_41":-5,"_29":30,"_145":-5,"_173":212,"_32":213},{"_48":203,"_37":204,"_35":205,"_138":149,"_46":47,"_45":206,"_140":64,"_43":207,"_13":68,"_39":40,"_41":208,"_29":30,"_145":-5,"_173":209,"_32":210},{"_48":199,"_37":38,"_35":36,"_138":149,"_46":47,"_45":14,"_140":64,"_43":200,"_13":68,"_39":40,"_41":42,"_29":30,"_145":-5,"_173":201,"_32":202},{"_48":191,"_37":192,"_35":193,"_138":149,"_46":47,"_45":194,"_140":64,"_43":195,"_13":68,"_39":40,"_41":196,"_29":30,"_145":-5,"_173":197,"_32":198},{"_48":184,"_37":185,"_35":186,"_138":149,"_46":47,"_45":150,"_140":64,"_43":187,"_13":68,"_39":40,"_41":188,"_29":30,"_145":-5,"_173":189,"_32":190},{"_48":176,"_37":177,"_35":178,"_138":149,"_46":47,"_45":179,"_140":64,"_43":180,"_13":68,"_39":40,"_41":181,"_29":30,"_145":-5,"_173":182,"_32":183},{"_48":136,"_37":137,"_35":62,"_138":-5,"_46":47,"_45":139,"_140":30,"_43":172,"_13":142,"_39":143,"_41":144,"_29":30,"_145":-5,"_173":174,"_32":175},["D",1784712150751],"children",[],[137],"14ae8848-8e4b-44c2-be86-0bb6c36c8ea1","utils.ts","270f37b6-8789-11f1-b06e-1607ee4eb77e",6,["D",1784915856065],"/**\n * Shared HTTP utilities: JSON responses, CORS, ID generation, auth.\n * Platform-agnostic — no Val Town-specific imports.\n */\n\nimport type { Merchant } from \"./types.ts\";\nimport { db } from \"./storage.ts\";\n\n// ── HTTP helpers ────────────────────────────────────────────────\n\nexport function json(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, PATCH, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Merchant-Key\",\n },\n });\n}\n\nexport function errorResponse(message: string, status = 400): Response {\n return json({ error: message }, status);\n}\n\nexport function html(content: string, status = 200): Response {\n return new Response(content, {\n status,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-cache\",\n },\n });\n}\n\nexport function corsPreflight(): Response {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, PUT, PATCH, DELETE, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Merchant-Key\",\n },\n });\n}\n\n// ── ID generators ───────────────────────────────────────────────\n\nexport function generateId(): string {\n return \"mrc_\" + crypto.randomUUID().replace(/-/g, \"\").slice(0, 16);\n}\n\nexport function generateApiKey(): string {\n const bytes = new Uint8Array(24);\n crypto.getRandomValues(bytes);\n return \"sk_\" +\n Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function generateSessionId(): string {\n return \"ses_\" + crypto.randomUUID().replace(/-/g, \"\");\n}\n\n// ── Authentication ──────────────────────────────────────────────\n\nexport async function authenticateMerchant(\n apiKey: string,\n): Promise {\n if (!apiKey) return null;\n try {\n const result = await db().execute({\n sql: \"SELECT * FROM merchants WHERE api_key = ?\",\n args: [apiKey],\n });\n if (result.rows.length === 0) return null;\n return result.rows[0] as unknown as Merchant;\n } catch {\n return null;\n }\n}\n\nexport async function getMerchantById(\n merchantId: string,\n): Promise {\n try {\n const result = await db().execute({\n sql: \"SELECT * FROM merchants WHERE id = ?\",\n args: [merchantId],\n });\n if (result.rows.length === 0) return null;\n return result.rows[0] as unknown as Merchant;\n } catch {\n return null;\n }\n}\n",[],[148,177],"8098a05b-4d32-4186-a8c6-17623ed0b8a8","types.ts","1aa28078-8789-11f1-89ae-1607ee4eb77e",["D",1784915835212],"/**\n * Shared type definitions + database abstraction interface.\n * Used by both the Val Town server (main.ts) and the Termux/local\n * server (termux/server.ts) so business logic is platform-agnostic.\n */\n\nexport interface Merchant {\n id: string;\n name: string;\n phone: string;\n country: string;\n webhook_url: string;\n api_key: string;\n created_at: string;\n}\n\nexport interface Product {\n id: number;\n merchant_id: string;\n name: string;\n price: number;\n description: string;\n stock: number;\n category: string;\n image_url: string;\n created_at: string;\n}\n\nexport interface Order {\n id: number;\n merchant_id: string;\n customer_name: string;\n customer_phone: string;\n customer_address: string;\n product_id: number;\n product_name: string;\n quantity: number;\n total_price: number;\n status: string;\n created_at: string;\n}\n\nexport interface ChatSession {\n id: string;\n merchant_id: string;\n customer_name: string | null;\n customer_phone: string | null;\n customer_address: string | null;\n product_id: number | null;\n product_name: string | null;\n quantity: number | null;\n state: string;\n updated_at: string;\n}\n\nexport interface ChatResponse {\n reply: string;\n session_id: string;\n order_booked: boolean;\n order_id?: number;\n dispatch_sent?: boolean;\n dispatch_error?: string;\n}\n\n/** Result shape returned by IDatabase.execute() */\nexport interface QueryResult {\n rows: Record[];\n rowsAffected: number;\n lastInsertRowid: bigint | null;\n}\n\n/**\n * Platform-agnostic database interface.\n * Matches the Val Town sqlite API surface so the same\n * business-logic code works on Val Town (libSQL) and\n * locally on Termux (node:sqlite).\n */\nexport interface IDatabase {\n execute(\n sql: string | { sql: string; args?: unknown[] },\n args?: unknown[],\n ): Promise;\n batch(statements: { sql: string; args?: unknown[] }[]): Promise;\n}\n",[],[148,185],"71bb3b3c-127b-4241-adbc-89022d28f918","storage.ts","21cf6ec4-8789-11f1-8c02-1607ee4eb77e",5,["D",1784915847169],"/**\n * Storage singleton — the single point where database access is resolved.\n *\n * On Val Town: main.ts calls setDatabase() with a thin wrapper around\n * https://esm.town/v/std/sqlite/main.ts\n *\n * On Termux / local Deno: termux/server.ts calls setDatabase() with a\n * wrapper around node:sqlite (DatabaseSync).\n *\n * All other lib modules import { db } from here and never touch a\n * platform-specific import, keeping business logic 100% portable.\n */\n\nimport type { IDatabase } from \"./types.ts\";\n\nlet _db: IDatabase | null = null;\n\n/** Called once during server startup to inject the platform adapter. */\nexport function setDatabase(adapter: IDatabase): void {\n _db = adapter;\n}\n\n/** Returns the configured database. Throws if setDatabase() was never called. */\nexport function db(): IDatabase {\n if (!_db) {\n throw new Error(\n \"Database not configured. Call setDatabase() before using any DB operations.\",\n );\n }\n return _db;\n}\n",[],[148,192],"5008cc6c-506a-4362-8a76-466a4203fae1",["D",1784915879160],[],[148,38],"4f23ea0c-4b95-4a42-b355-256e3bb3b3e0","db.ts","2aac0fb6-8789-11f1-a92b-1607ee4eb77e",7,["D",1784915862125],"/**\n * Database schema initialization.\n * Creates all tables and indexes if they don't exist.\n * Called once on server startup (idempotent).\n */\n\nimport { db } from \"./storage.ts\";\n\nexport async function initDatabase(): Promise {\n const database = db();\n\n await database.execute(`\n CREATE TABLE IF NOT EXISTS merchants (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n phone TEXT NOT NULL,\n country TEXT NOT NULL,\n webhook_url TEXT NOT NULL,\n api_key TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )\n `);\n\n await database.execute(`\n CREATE TABLE IF NOT EXISTS products (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n merchant_id TEXT NOT NULL,\n name TEXT NOT NULL,\n price REAL NOT NULL,\n description TEXT DEFAULT '',\n stock INTEGER DEFAULT 0,\n category TEXT DEFAULT 'general',\n image_url TEXT DEFAULT '',\n created_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id)\n )\n `);\n\n await database.execute(`\n CREATE TABLE IF NOT EXISTS orders (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n merchant_id TEXT NOT NULL,\n customer_name TEXT NOT NULL,\n customer_phone TEXT NOT NULL,\n customer_address TEXT NOT NULL,\n product_id INTEGER NOT NULL,\n product_name TEXT NOT NULL,\n quantity INTEGER NOT NULL,\n total_price REAL NOT NULL,\n status TEXT DEFAULT 'booked',\n created_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id),\n FOREIGN KEY (product_id) REFERENCES products(id)\n )\n `);\n\n await database.execute(`\n CREATE TABLE IF NOT EXISTS chat_sessions (\n id TEXT PRIMARY KEY,\n merchant_id TEXT NOT NULL,\n customer_name TEXT,\n customer_phone TEXT,\n customer_address TEXT,\n product_id INTEGER,\n product_name TEXT,\n quantity INTEGER,\n state TEXT DEFAULT 'browsing',\n updated_at TEXT NOT NULL,\n FOREIGN KEY (merchant_id) REFERENCES merchants(id)\n )\n `);\n\n await database.execute(\n \"CREATE INDEX IF NOT EXISTS idx_products_merchant ON products(merchant_id)\",\n );\n await database.execute(\n \"CREATE INDEX IF NOT EXISTS idx_orders_merchant ON orders(merchant_id)\",\n );\n await database.execute(\n \"CREATE INDEX IF NOT EXISTS idx_chat_sessions_merchant ON chat_sessions(merchant_id)\",\n );\n}\n",[],[148,204],["D",1784915835212],[166,167,168,169,170],[148],["D",1784711864701],["D",1789572079973],{"_105":104,"_112":107},{"_105":104,"_106":107,"_108":107,"_19":60,"_109":110,"_111":30},{"_13":94,"_37":95,"_48":47,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"ctx",{"_87":-5,"_131":252,"_253":254,"_255":256,"_257":30,"_258":30,"_259":30,"_260":64,"_261":-5,"_262":-7,"_263":-7,"_264":68,"_265":30,"_266":30,"_267":-5,"_268":30,"_269":30,"_270":30,"_271":-5},"ENV",{"_223":224,"_225":226,"_227":95,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8